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Dated: 22 June 2021 

Subject: Deprecation of global scope support in TCF 

Dear TCF Vendors and CMPs, 

The TCF Steering Group has approved amendments to the TCF Policy and Technical 
Specifications to deprecate support for global scope and Out-of-Band (OOB) in the 


Framework. 


Further background as well as implementation deadlines are provided below. Please also 
consult the latest versions of the TCF Policy and Technical Specifications. 


Background 

The TCF Policy allows legal bases in the Framework to be established with global scope, 
which means a legal basis is not only applicable on the service (local scope) where it is 
obtained and managed, but all services implementing global scope preferences. Depending 
on the service preference described, consent can then be stored either locally on the service 
on which it is obtained or globally. When storing the consent globally, the consent will be 
stored in a 3rd party cookie with the “TC String” format associated with the “consensu.org” 
domain. Consensu.org is a domain name that enables the Consent Management Providers 
(CMPs) to read the “TC string” from their subdomains [cmp-name].mgr.consensu.org across 
different services. As a reminder a subdomain [cmp-name].mgr.consensu.org points to the 
CMP's own servers. 


When considering a recommendation to the Steering Group to deprecate support for global 
scope in the TCF, the TCF Policies Working Group took account of the following: 


e Indication by several DPAs (including CNIL in France and AEPD in Spain) that users 
should be clearly informed of the digital properties where their choices apply, for 
example by being provided with a list of domains. The TCF does not create a 
standardised way of listing of digital properties implementing TCF in the global 
scope; 

e Considerations related to the legality of cookie walls and paywalls, which in a case- 
by-case assessment scenario by DPAs, may depend on the nature of the service and 
the quality of an equivalent alternative. This means that, for example, consent 
provided on one digital property may not be considered valid on another; 

e Considerations related to the overall negligible use of global scope by publishers, the 
majority of which prefer to control and manage user consent on their properties only 
and maintain their unique relationship with the user. 


Alongside the deprecation of global scope, TCF Policy will also be updated to remove any 
references to Out-of-Band (OOB). OOB refers to those instances where a legal basis has not 
been established using the TCF and is therefore not reflected in any of the signals within the 
Framework. OOB can only be recognised in global scope. 
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Policy amendments 
The TCF Policy will been updated to remove any references to “global scope” and "OOB" 
including from: 


e Policy 1(19) removal (c) and (d) 
e Policy 5(2) 

e Policy 16 (15) 

e Policy 16 (16) 

e Policy 16 (18) 

e Appendix B, Policy B(f) 

e Appendix B, Policy C(b)(vii) 

e Appendix B, Policy D(O() 


The technical specification will also be updated to remove any references to "global scope” 
and “OOB". 


Next Steps 
e By July 1st 2021: 
o CMPs must update their configuration so that they no longer make use of 
global scope, therefore: 
= CMPs must no longer write TC Strings in the 'euconsent-v2' cookie 
associated with the consensu.org domain; 
= CMPs must only read or write TC Strings in a service-specific context 
on the website that the user has visited; 
= The CMP user interface must no longer make any reference to global 
scope consent; 
o The Managing Organisation (MO) will no longer delegate a subdomain of the 
consensu.org domain to each newly registered CMP; 
e As of September 1st 2021: 
o Global scope strings will be considered invalid; 
o CMPs must no longer read and process TC Strings in the ‘euconsent-v2' 
cookie associated with the consensu.org domain; 
o CMPs that previously operated in global scope must delete existing 
‘euconsent-v2' cookies associated with the consensu.org domain 


Note: The removal of support for global scope within the TCF does not affect group-specific 
scope, which uses mechanisms identical to service-specific scope and only applies on a 
limited number of pre-defined properties (e.g., of a single publisher) that must be 
communicated to the user. 
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